PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#851Online Scheduling and Appointment Booking System – Bookly251,08888860k+SQL query is not prepared
#852Breeze Cache25218800400k+Non-prefixed global variable
#853Broken Link Checker25727600500k+Output is not escaped
#854BuddyPress Docs252844217k+Nonce verification recommended
#855Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor251,0411,0164k+Text Domain Mismatch
#856Bulk Edit and Create User Profiles – WP Sheet Editor259951,0011k+Text Domain Mismatch
#857PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus253621,586100k+Non-prefixed global variable
#858SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce)2523521410k+Database parameter is not escaped
#859GSheetConnector for CF7 – Connect Contact Form 7 to Google Sheets and Send Form Submissions in Real Time256141,43140k+Non-prefixed global variable
#860CheckoutWC Lite – Conversion optimized WooCommerce checkout251,4168543k+Text Domain Mismatch
#861CheckView – Form & Checkout Testing25663371k+Direct Query
#862HIPAA FORMS25414416800Request data is not unslashed
#863Admin Columns25613995100k+Non-prefixed namespace
#864Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#865Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode25991,040700k+Non-prefixed global variable
#866Disable Comments & Delete All Comments255031859k+Output is not escaped
#867Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress254983551k+Text Domain Mismatch
#868Contact Form Email254098989k+Non-prefixed global variable
#869Coupon Creator256984121k+Output is not escaped
#870CP Contact Form with PayPal25466936800Unsafe printing function
#871Cryptocurrency Payment Gateway251,963589400Text Domain Mismatch
#872CSS & JavaScript Toolbox2515561710k+Non-prefixed class
#873Smash Balloon Social Post Feed – Simple Social Feeds for WordPress25554982200k+Output is not escaped
#874DecaLog259432361k+Exception output is not escaped
#875Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#876Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#877ELEX WooCommerce Dynamic Pricing and Discounts25478748800Text Domain Mismatch
#878WEB-Translation – eTranslation Multilingual252171,057400Non-prefixed function
#879Show Eventbrite Events – Event Feed for Eventbrite255951,525800Non-prefixed global variable
#880Event Genius – Event Management, Events Calendar, Registration, and RSVP251811,579500Non-prefixed global variable
#881Events Made Easy255216,3241k+Non-prefixed function
#882F4 Post Tree255361,332500Non-prefixed global variable
#883胖鼠采集(Fat Rat Collect)25630190900Missing Arg Domain
#884FlatPM – Ad Manager, AdSense and Custom Code253,01755710k+Text Domain Mismatch
#885FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler253214557k+Non-prefixed global variable
#886Fluid Checkout for WooCommerce – Lite2537084120k+Non-prefixed hook name
#887Lightbox & Modal Popup WordPress Plugin – FooBox256101,365100k+Non-prefixed global variable
#888Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel258761,798100k+Non-prefixed global variable
#889AnWP Football Leagues253,5981,955800Text Domain Mismatch
#890WP Fast Total Search – The Power of Indexed Search252092911k+Non-prefixed global variable
#891FunnelKit – Funnel Builder for WooCommerce Checkout253,1642,62430k+Text Domain Mismatch
#892Gallery Images Ape255883411k+Output is not escaped
#893Photo Gallery by Ays – Responsive Image Gallery254668201k+Output is not escaped
#894GD Rating System251,5111,0431k+Output is not escaped
#895GD Security Headers254075211k+Output is not escaped
#896GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content25888636k+Non-prefixed global variable
#897Genesis Club Lite25513317900Output is not escaped
#898Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)25401,0571k+Non-prefixed global variable
#899Simple Giveaways – Grow your business, email lists and traffic with contests259562,384400Non-prefixed global variable
#900WPBruiser {no- Captcha anti-Spam}2564625910k+Non Singular String Literal Domain